"Darren Spruell" <[EMAIL PROTECTED]> writes:
> On 3/18/07, Sid Carter <[EMAIL PROTECTED]> wrote:
>> greylisting. On further investigation, we found out that the MS Mail
>> servers send a NOOP before they start sending other SMTP commands and
>> spamd returns a 451 even for a NOOP causing the SMTP connection to
>> terminate and the connecting mail server doesn't even get greylisted,
>> since it hasn't even sent a "MAIL FROM" and "RCPT TO".
>>
> Might be useful if you would include details, and lots of them, on a
> subject like this. "MS Mail Servers" is generic and meaningless; is it
> Exchange? Is it the SMTP Server? Something else? What software
> version(s)? OSes and versions?
I would just connect back to the IP which was showing this sympton and
those gave me the greeting as "Microsoft Mail Server". I could be wrong
though.
> More than anything, packet captures illustrating the behavior would be
> useful too.
Packet capture enclosed, taken on March 16th, before we applied the NOOP
patch.
Sid
11:05:23.401112 IP mail.client.57542 > spamd.server.smtp: . ack 3849587282 win
5840 <nop,nop,timestamp 8504300 1654958060>
[EMAIL PROTECTED]
R.....A.....
....b...
11:05:24.086139 IP spamd.server.smtp > mail.client.57542: P 1:2(1) ack 0 win
17376 <nop,nop,timestamp 1654958062 8504300>
[EMAIL PROTECTED]@.3 ..*..1.......t
RB.....C..%.....
b.......
11:05:24.127337 IP mail.client.57542 > spamd.server.smtp: . ack 2 win 5840
<nop,nop,timestamp 8504373 1654958062>
[EMAIL PROTECTED]
S...........
...5b...
11:05:25.075553 IP spamd.server.smtp > mail.client.57542: P 2:3(1) ack 0 win
17376 <nop,nop,timestamp 1654958064 8504373>
[EMAIL PROTECTED]@.....*..1.......t
SB.....C........
b......5b
11:05:25.119287 IP mail.client.57542 > spamd.server.smtp: . ack 3 win 5840
<nop,nop,timestamp 8504472 1654958064>
[EMAIL PROTECTED]
T...........
....b...
11:05:26.012268 IP spamd.server.smtp > mail.client.57542: P 3:4(1) ack 0 win
17376 <nop,nop,timestamp 1654958066 8504472>
[EMAIL PROTECTED]@.3,..*..1.......t
TB.....C..s.....
b.......a
11:05:26.052768 IP mail.client.57542 > spamd.server.smtp: . ack 4 win 5840
<nop,nop,timestamp 8504565 1654958066>
[EMAIL PROTECTED]
U...../.....
....b...
11:05:27.137071 IP spamd.server.smtp > mail.client.57542: P 4:5(1) ack 0 win
17376 <nop,nop,timestamp 1654958068 8504565>
[EMAIL PROTECTED]@.5...*..1.......t
UB.....C.x......
b.......s
11:05:27.180269 IP mail.client.57542 > spamd.server.smtp: . ack 5 win 5840
<nop,nop,timestamp 8504678 1654958068>
[EMAIL PROTECTED]
V...........
...fb...
11:05:28.072700 IP spamd.server.smtp > mail.client.57542: P 5:6(1) ack 0 win
17376 <nop,nop,timestamp 1654958070 8504678>
[EMAIL PROTECTED]@.....*..1.......t
VB.....C........
b......fi
11:05:28.112502 IP mail.client.57542 > spamd.server.smtp: . ack 6 win 5840
<nop,nop,timestamp 8504771 1654958070>
[EMAIL PROTECTED]
W.....[.....
....b...
11:05:29.037260 IP spamd.server.smtp > mail.client.57542: P 6:7(1) ack 0 win
17376 <nop,nop,timestamp 1654958072 8504771>
[EMAIL PROTECTED]@. ...*..1.......t
WB.....C.~?.....
b.......l
11:05:29.078219 IP mail.client.57542 > spamd.server.smtp: . ack 7 win 5840
<nop,nop,timestamp 8504868 1654958072>
[EMAIL PROTECTED]
X...........
...$b...
11:05:30.037350 IP spamd.server.smtp > mail.client.57542: P 7:8(1) ack 0 win
17376 <nop,nop,timestamp 1654958074 8504868>
[EMAIL PROTECTED]@.;...*..1.......t
XB.....C........
b......$i
11:05:30.077915 IP mail.client.57542 > spamd.server.smtp: . ack 8 win 5840
<nop,nop,timestamp 8504968 1654958074>
[EMAIL PROTECTED]
Y...........
....b...
11:05:31.027281 IP spamd.server.smtp > mail.client.57542: P 8:86(78) ack 0 win
17376 <nop,nop,timestamp 1654958076 8504968>
[EMAIL PROTECTED]@..m..*..1.......t
YB.....C........
b.......sk.boing.org.nz ESMTP spamd I
11:05:31.069865 IP mail.client.57542 > spamd.server.smtp: . ack 86 win 5840
<nop,nop,timestamp 8505067 1654958076>
[EMAIL PROTECTED]
............
....b...
11:05:31.069867 IP mail.client.57542 > spamd.server.smtp: P 0:30(30) ack 86 win
5840 <nop,nop,timestamp 8505067 1654958076>
[EMAIL PROTECTED]
............
....b...NOOP
11:05:31.070423 IP spamd.server.smtp > mail.client.57542: P 86:134(48) ack 30
win 17376 <nop,nop,timestamp 1654958076 8505067>
[EMAIL PROTECTED]@..2..*..1.......t
.B.....C........
b.......451 Temporary failure, please
11:05:31.070541 IP spamd.server.smtp > mail.client.57542: F 134:134(0) ack 30
win 17376 <nop,nop,timestamp 1654958076 8505067>
[EMAIL PROTECTED]@.:3..*..1.......t
.B.....C..}.....
b.......
11:05:31.111720 IP mail.client.57542 > spamd.server.smtp: P 30:36(6) ack 134
win 5840 <nop,nop,timestamp 8505071 1654958076>
E..:[EMAIL PROTECTED]
.....m......
....b...QUIT
11:05:31.111764 IP spamd.server.smtp > mail.client.57542: R
3849587415:3849587415(0) win 0
E..([EMAIL PROTECTED]@.....*..1.......t
.
....P.......
11:05:31.111843 IP mail.client.57542 > spamd.server.smtp: F 36:36(0) ack 135
win 5840 <nop,nop,timestamp 8505071 1654958076>
[EMAIL PROTECTED]
............
....b...
11:05:31.111866 IP spamd.server.smtp > mail.client.57542: R
3849587416:3849587416(0) win 0
E..([EMAIL PROTECTED]@.M...*..1.......t
.
....P.......
11:05:35.784386 IP mail.client.57557 > spamd.server.smtp: S
1132947596:1132947596(0) win 5840 <mss 1460,sackOK,timestamp 8505539
0,nop,wscale 0>
E..<[EMAIL PROTECTED]:..1....*.....C.h.........{K.........
............
11:05:35.784471 IP spamd.server.smtp > mail.client.57557: S
3660589841:3660589841(0) ack 1132947597 win 16384 <mss
1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 1993550897 8505539>
E..@&[EMAIL PROTECTED]@[EMAIL PROTECTED]
v.,1....
11:05:35.824111 IP mail.client.57557 > spamd.server.smtp: . ack 1 win 5840
<nop,nop,timestamp 8505543 1993550897>
[EMAIL PROTECTED];..1....*.....C.h..0+............
....v.,1
11:05:36.024340 IP spamd.server.smtp > mail.client.57557: P 1:2(1) ack 1 win
17376 <nop,nop,timestamp 1993550898 8505543>
[EMAIL PROTECTED]@.....*..1.......0+.C.h...C........
v.,2....2
11:05:36.068103 IP mail.client.57557 > spamd.server.smtp: . ack 2 win 5840
<nop,nop,timestamp 8505567 1993550898>
[EMAIL PROTECTED];..1....*.....C.h..0+............
....v.,2
11:05:37.010747 IP spamd.server.smtp > mail.client.57557: P 2:3(1) ack 1 win
17376 <nop,nop,timestamp 1993550900 8505567>
[EMAIL PROTECTED]@.{A..*..1.......0+.C.h...C........
v.,4....2
11:05:37.054303 IP mail.client.57557 > spamd.server.smtp: . ack 3 win 5840
<nop,nop,timestamp 8505666 1993550900>
[EMAIL PROTECTED];..1....*.....C.h..0+......5.....
...Bv.,4
11:05:38.137657 IP spamd.server.smtp > mail.client.57557: P 3:4(1) ack 1 win
17376 <nop,nop,timestamp 1993550902 8505666>
[EMAIL PROTECTED]@..J..*..1.......0+.C.h...C........
v.,6...B0
11:05:38.179803 IP mail.client.57557 > spamd.server.smtp: . ack 4 win 5840
<nop,nop,timestamp 8505778 1993550902>
E..4. @.1.:..1....*.....C.h..0+............
....v.,6
11:05:39.026357 IP spamd.server.smtp > mail.client.57557: P 4:5(1) ack 1 win
17376 <nop,nop,timestamp 1993550904 8505778>
[EMAIL PROTECTED]@.h...*..1.......0+.C.h...C........
v.,8....
11:05:39.068064 IP mail.client.57557 > spamd.server.smtp: . ack 5 win 5840
<nop,nop,timestamp 8505867 1993550904>
[EMAIL PROTECTED]:..1....*.....C.h..0+......f.....
....v.,8
11:05:40.005586 IP spamd.server.smtp > mail.client.57557: P 5:6(1) ack 1 win
17376 <nop,nop,timestamp 1993550906 8505867>
E..5/[EMAIL PROTECTED]@.....*..1.......0+.C.h...C.qJ.....
v.,:....b
11:05:40.047020 IP mail.client.57557 > spamd.server.smtp: . ack 6 win 5840
<nop,nop,timestamp 8505965 1993550906>
E..4."@.1.:..1....*.....C.h..0+............
...mv.,:
11:05:41.056060 IP spamd.server.smtp > mail.client.57557: P 6:7(1) ack 1 win
17376 <nop,nop,timestamp 1993550908 8505965>
[EMAIL PROTECTED]@..
..*..1.......0+.C.h...C.q......
v.,<...ma
11:05:41.097189 IP mail.client.57557 > spamd.server.smtp: . ack 7 win 5840
<nop,nop,timestamp 8506070 1993550908>
[EMAIL PROTECTED]:..1....*.....C.h..0+............
....v.,<
11:05:42.077800 IP spamd.server.smtp > mail.client.57557: P 7:8(1) ack 1 win
17376 <nop,nop,timestamp 1993550910 8506070>
[EMAIL PROTECTED]@.iL..*..1.......0+.C.h...C._y.....
v.,>....s
11:05:42.119623 IP mail.client.57557 > spamd.server.smtp: . ack 8 win 5840
<nop,nop,timestamp 8506172 1993550910>
[EMAIL PROTECTED]:..1....*.....C.h..0+......+.....
...<v.,>
11:05:43.316652 IP spamd.server.smtp > mail.client.57557: P 8:9(1) ack 1 win
17376 <nop,nop,timestamp 1993550912 8506172>
[EMAIL PROTECTED]@.m...*..1.......0+.C.h...C.i......
v.,@...<i
11:05:43.358187 IP mail.client.57557 > spamd.server.smtp: . ack 9 win 5840
<nop,nop,timestamp 8506296 1993550912>
[EMAIL PROTECTED]:..1....*.....C.h..0+............
....v.,@
11:05:44.043297 IP spamd.server.smtp > mail.client.57557: P 9:10(1) ack 1 win
17376 <nop,nop,timestamp 1993550914 8506296>
[EMAIL PROTECTED]@.....*..1.......0+.C.h...C.e......
v.,B....l
11:05:44.084285 IP mail.client.57557 > spamd.server.smtp: . ack 10 win 5840
<nop,nop,timestamp 8506369 1993550914>
E..4.&@.1.:..1....*.....C.h..0+......`.....
....v.,B
11:05:45.121245 IP spamd.server.smtp > mail.client.57557: P 10:11(1) ack 1 win
17376 <nop,nop,timestamp 1993550916 8506369>
E..5|[EMAIL PROTECTED]@.^...*..1.......0+.C.h...C.hE.....
v.,D....i
11:05:45.163060 IP mail.client.57557 > spamd.server.smtp: . ack 11 win 5840
<nop,nop,timestamp 8506476 1993550916>
E..4.'@.1.:..1....*.....C.h..0+............
...lv.,D
11:05:46.043338 IP spamd.server.smtp > mail.client.57557: P 11:89(78) ack 1 win
17376 <nop,nop,timestamp 1993550918 8506476>
[EMAIL PROTECTED]@..H..*..1.......0+.C.h...C........
v.,F...lsk.boing.org.nz ESMTP spamd I
11:05:46.086677 IP mail.client.57557 > spamd.server.smtp: . ack 89 win 5840
<nop,nop,timestamp 8506569 1993550918>
E..4.(@.1.:..1....*.....C.h..0+j.....E.....
....v.,F
11:05:46.087302 IP mail.client.57557 > spamd.server.smtp: P 1:31(30) ack 89 win
5840 <nop,nop,timestamp 8506569 1993550918>
E..R.)@.1.:..1....*.....C.h..0+j...........
....v.,FNOOP
11:05:46.088015 IP spamd.server.smtp > mail.client.57557: P 89:137(48) ack 31
win 17376 <nop,nop,timestamp 1993550918 8506569>
[EMAIL PROTECTED]@..`..*..1.......0+jC.h...C..U.....
v.,F....451 Temporary failure, please
11:05:46.088153 IP spamd.server.smtp > mail.client.57557: F 137:137(0) ack 31
win 17376 <nop,nop,timestamp 1993550918 8506569>
[EMAIL PROTECTED]@.....*..1.......0+.C.h...C........
v.,F....
11:05:46.129028 IP mail.client.57557 > spamd.server.smtp: P 31:37(6) ack 138
win 5840 <nop,nop,timestamp 8506573 1993550918>
E..:[EMAIL PROTECTED]:..1....*.....C.h..0+.....U1.....
....v.,FQUIT
11:05:46.129030 IP mail.client.57557 > spamd.server.smtp: F 37:37(0) ack 138
win 5840 <nop,nop,timestamp 8506573 1993550918>
[EMAIL PROTECTED]:..1....*.....C.h..0+............
....v.,F
11:05:46.129072 IP spamd.server.smtp > mail.client.57557: R
3660589979:3660589979(0) win 0
E..([EMAIL PROTECTED]@.....*..1.......0+.....P...i...
11:05:46.129091 IP spamd.server.smtp > mail.client.57557: R
3660589979:3660589979(0) win 0
E..(
.
@[EMAIL PROTECTED]
11:05:46.169756 IP mail.client.57557 > spamd.server.smtp: R 0:0(0) win 17376
E..(.!....o .1....*.............P.C.+m........
11:05:47.789107 IP mail.client.57572 > spamd.server.smtp: S
1147378386:1147378386(0) win 5840 <mss 1460,sackOK,timestamp 8506739
0,nop,wscale 0>
E..<[EMAIL PROTECTED]
...s........
11:05:47.789177 IP spamd.server.smtp > mail.client.57572: S
3432723956:3432723956(0) ack 1147378387 win 16384 <mss
1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 3169905972 8506739>
E..@<[EMAIL PROTECTED]@[EMAIL PROTECTED]
...4...s
11:05:47.830584 IP mail.client.57572 > spamd.server.smtp: . ack 1 win 5840
<nop,nop,timestamp 8506743 3169905972>
[EMAIL PROTECTED]
...w...4
11:05:48.030057 IP spamd.server.smtp > mail.client.57572: P 1:2(1) ack 1 win
17376 <nop,nop,timestamp 3169905973 8506743>
[EMAIL PROTECTED]@[EMAIL PROTECTED]
...5...w2
11:05:48.070577 IP mail.client.57572 > spamd.server.smtp: . ack 2 win 5840
<nop,nop,timestamp 8506767 3169905973>
[EMAIL PROTECTED]|.1....*.....Dc....5......J.....
.......5
11:05:49.170807 IP spamd.server.smtp > mail.client.57572: P 2:3(1) ack 1 win
17376 <nop,nop,timestamp 3169905975 8506767>
[EMAIL PROTECTED]@.z...*..1........5.Dc....C.f/.....
...7....2
11:05:49.211696 IP mail.client.57572 > spamd.server.smtp: . ack 3 win 5840
<nop,nop,timestamp 8506881 3169905975>
[EMAIL PROTECTED]
.......7
11:05:50.137870 IP spamd.server.smtp > mail.client.57572: P 3:4(1) ack 1 win
17376 <nop,nop,timestamp 3169905977 8506881>
[EMAIL PROTECTED]@.....*..1........5.Dc....C.g......
...9....0
11:05:50.179409 IP mail.client.57572 > spamd.server.smtp: . ack 4 win 5840
<nop,nop,timestamp 8506978 3169905977>
[EMAIL PROTECTED]
...b...9
11:05:51.048783 IP spamd.server.smtp > mail.client.57572: P 4:5(1) ack 1 win
17376 <nop,nop,timestamp 3169905979 8506978>
E..5W|@[EMAIL PROTECTED]
...;...b
11:05:51.094284 IP mail.client.57572 > spamd.server.smtp: . ack 5 win 5840
<nop,nop,timestamp 8507069 3169905979>
[EMAIL PROTECTED]
.......;
11:05:52.053541 IP spamd.server.smtp > mail.client.57572: P 5:6(1) ack 1 win
17376 <nop,nop,timestamp 3169905981 8507069>
[EMAIL PROTECTED]@..?..*..1........5.Dc....C.4......
...=....b
11:05:52.094976 IP mail.client.57572 > spamd.server.smtp: . ack 6 win 5840
<nop,nop,timestamp 8507170 3169905981>
[EMAIL PROTECTED]
..."...=
11:05:53.030646 IP spamd.server.smtp > mail.client.57572: P 6:7(1) ack 1 win
17376 <nop,nop,timestamp 3169905983 8507170>
[EMAIL PROTECTED]@.....*..1........5.Dc....C.5......
...?..."a
11:05:53.071552 IP mail.client.57572 > spamd.server.smtp: . ack 7 win 5840
<nop,nop,timestamp 8507267 3169905983>
[EMAIL PROTECTED]
.......?
11:05:54.004528 IP spamd.server.smtp > mail.client.57572: P 7:8(1) ack 1 win
17376 <nop,nop,timestamp 3169905985 8507267>
[EMAIL PROTECTED]@.u2..*..1........5.Dc....C.#,.....
...A....s
11:05:54.046895 IP mail.client.57572 > spamd.server.smtp: . ack 8 win 5840
<nop,nop,timestamp 8507365 3169905985>
[EMAIL PROTECTED]
.......A
11:05:55.056770 IP spamd.server.smtp > mail.client.57572: P 8:9(1) ack 1 win
17376 <nop,nop,timestamp 3169905987 8507365>
E..5
[EMAIL PROTECTED]@.....*..1........5.Dc....C.,......
...C....i
11:05:55.098436 IP mail.client.57572 > spamd.server.smtp: . ack 9 win 5840
<nop,nop,timestamp 8507470 3169905987>
[EMAIL PROTECTED]
...N...C
11:05:56.179266 IP spamd.server.smtp > mail.client.57572: P 9:10(1) ack 1 win
17376 <nop,nop,timestamp 3169905989 8507470>
[EMAIL PROTECTED]@.....*..1........5.Dc....C.)[.....
...E...Nl
11:05:56.220191 IP mail.client.57572 > spamd.server.smtp: . ack 10 win 5840
<nop,nop,timestamp 8507582 3169905989>
[EMAIL PROTECTED]
.......E
11:05:57.033178 IP spamd.server.smtp > mail.client.57572: P 10:11(1) ack 1 win
17376 <nop,nop,timestamp 3169905991 8507582>
[EMAIL PROTECTED]@.....*..1........5.Dc....C.+......
...G....i
11:05:57.073966 IP mail.client.57572 > spamd.server.smtp: . ack 11 win 5840
<nop,nop,timestamp 8507668 3169905991>
[EMAIL PROTECTED]
.......G
11:05:58.311202 IP spamd.server.smtp > mail.client.57572: P 11:89(78) ack 1 win
17376 <nop,nop,timestamp 3169905993 8507668>
[EMAIL PROTECTED]@.`...*..1........5.Dc....C........
...I....sk.boing.org.nz ESMTP spamd I
11:05:58.359379 IP mail.client.57572 > spamd.server.smtp: . ack 89 win 5840
<nop,nop,timestamp 8507796 3169905993>
[EMAIL PROTECTED]
.......I
11:05:58.359381 IP mail.client.57572 > spamd.server.smtp: P 1:31(30) ack 89 win
5840 <nop,nop,timestamp 8507796 3169905993>
[EMAIL PROTECTED]
.......INOOP
11:05:58.359908 IP spamd.server.smtp > mail.client.57572: P 89:137(48) ack 31
win 17376 <nop,nop,timestamp 3169905993 8507796>
E..d|[EMAIL PROTECTED]@.^...*..1........6MDc....C........
...I....451 Temporary failure, please
11:05:58.360036 IP spamd.server.smtp > mail.client.57572: F 137:137(0) ack 31
win 17376 <nop,nop,timestamp 3169905993 8507796>
[EMAIL PROTECTED]@.....*..1........6}Dc....C..{.....
...I....
11:05:58.399858 IP mail.client.57572 > spamd.server.smtp: P 31:37(6) ack 137
win 5840 <nop,nop,timestamp 8507800 3169905993>
E..:[EMAIL PROTECTED]
.......IQUIT
11:05:58.399886 IP spamd.server.smtp > mail.client.57572: R
3432724093:3432724093(0) win 0
E..([EMAIL PROTECTED]@..p..*..1........6}....P...l%..
11:05:58.400233 IP mail.client.57572 > spamd.server.smtp: F 37:37(0) ack 138
win 5840 <nop,nop,timestamp 8507800 3169905993>
[EMAIL PROTECTED]
.......I
11:05:58.400253 IP spamd.server.smtp > mail.client.57572: R
3432724094:3432724094(0) win 0
E..([EMAIL PROTECTED]@..|..*..1........6~....P...l$..
11:05:59.789463 IP mail.client.57588 > spamd.server.smtp: S
1163439136:1163439136(0) win 5840 <mss 1460,sackOK,timestamp 8507939
0,nop,wscale 0>
E..<[EMAIL PROTECTED] ........,g.........
...#........
11:05:59.789518 IP spamd.server.smtp > mail.client.57588: S
2840611954:2840611954(0) ack 1163439137 win 16384 <mss
1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 2669107061 8507939>
[EMAIL PROTECTED]@[EMAIL PROTECTED]@....................
..Wu...#
11:05:59.830315 IP mail.client.57588 > spamd.server.smtp: . ack 1 win 5840
<nop,nop,timestamp 8507943 2669107061>
[EMAIL PROTECTED]
...'..Wu
11:06:00.010448 IP spamd.server.smtp > mail.client.57588: P 1:2(1) ack 1 win
17376 <nop,nop,timestamp 2669107062 8507943>
[EMAIL PROTECTED]@..B..*..1.......PLsEX.!..C........
..Wv...'2
11:06:00.052068 IP mail.client.57588 > spamd.server.smtp: . ack 2 win 5840
<nop,nop,timestamp 8507965 2669107062>
[EMAIL PROTECTED]
...=..Wv
11:06:01.036219 IP spamd.server.smtp > mail.client.57588: P 2:3(1) ack 1 win
17376 <nop,nop,timestamp 2669107064 8507965>
[EMAIL PROTECTED]@.g...*..1.......PLtEX.!..C........
..Wx...=2
11:06:01.076752 IP mail.client.57588 > spamd.server.smtp: . ack 3 win 5840
<nop,nop,timestamp 8508068 2669107064>
[EMAIL PROTECTED]
......Wx
11:06:02.082307 IP spamd.server.smtp > mail.client.57588: P 3:4(1) ack 1 win
17376 <nop,nop,timestamp 2669107066 8508068>
[EMAIL PROTECTED]@.....*..1.......PLuEX.!..C..*.....
..Wz....0
11:06:02.123670 IP mail.client.57588 > spamd.server.smtp: . ack 4 win 5840
<nop,nop,timestamp 8508173 2669107066>
[EMAIL PROTECTED]
...
..Wz
11:06:03.098048 IP spamd.server.smtp > mail.client.57588: P 4:5(1) ack 1 win
17376 <nop,nop,timestamp 2669107068 8508173>
[EMAIL PROTECTED]@.e...*..1.......PLvEX.!..C. ......
..W|...
11:06:03.140482 IP mail.client.57588 > spamd.server.smtp: . ack 5 win 5840
<nop,nop,timestamp 8508274 2669107068>
[EMAIL PROTECTED]
...r..W|
11:06:04.071130 IP spamd.server.smtp > mail.client.57588: P 5:6(1) ack 1 win
17376 <nop,nop,timestamp 2669107070 8508274>
[EMAIL PROTECTED]@.....*..1.......PLwEX.!..C..U.....
..W~...rb
11:06:04.112818 IP mail.client.57588 > spamd.server.smtp: . ack 6 win 5840
<nop,nop,timestamp 8508371 2669107070>
E..4~ @.1.l..1....*.....EX.!.PLx....m
.....
......W~
11:06:05.017616 IP spamd.server.smtp > mail.client.57588: P 6:7(1) ack 1 win
17376 <nop,nop,timestamp 2669107072 8508371>
E..5'[EMAIL PROTECTED]@.....*..1.......PLxEX.!..C........
..W.....a
11:06:05.058921 IP mail.client.57588 > spamd.server.smtp: . ack 7 win 5840
<nop,nop,timestamp 8508466 2669107072>
E..4~
@.1.l..1....*.....EX.!.PLy....l......
...2..W.
11:06:06.206229 IP spamd.server.smtp > mail.client.57588: P 7:8(1) ack 1 win
17376 <nop,nop,timestamp 2669107074 8508466>
[EMAIL PROTECTED]@.{...*..1.......PLyEX.!..C........
..W....2s
11:06:06.247638 IP mail.client.57588 > spamd.server.smtp: . ack 8 win 5840
<nop,nop,timestamp 8508585 2669107074>
[EMAIL PROTECTED]
......W.
11:06:07.035434 IP spamd.server.smtp > mail.client.57588: P 8:9(1) ack 1 win
17376 <nop,nop,timestamp 2669107076 8508585>
[EMAIL PROTECTED]@.....*..1.......PLzEX.!..C........
..W.....i
11:06:07.077804 IP mail.client.57588 > spamd.server.smtp: . ack 9 win 5840
<nop,nop,timestamp 8508668 2669107076>
[EMAIL PROTECTED]
......W.
11:06:08.104999 IP spamd.server.smtp > mail.client.57588: P 9:10(1) ack 1 win
17376 <nop,nop,timestamp 2669107078 8508668>
E..5z/@[EMAIL PROTECTED]
..W.....l
11:06:08.146213 IP mail.client.57588 > spamd.server.smtp: . ack 10 win 5840
<nop,nop,timestamp 8508775 2669107078>
E..4~
@.1.l..1....*.....EX.!.PL|....km.....
...g..W.
11:06:09.029362 IP spamd.server.smtp > mail.client.57588: P 10:11(1) ack 1 win
17376 <nop,nop,timestamp 2669107080 8508775>
[EMAIL PROTECTED]@.}#..*..1.......PL|EX.!..C..Q.....
..W....gi
11:06:09.071448 IP mail.client.57588 > spamd.server.smtp: . ack 11 win 5840
<nop,nop,timestamp 8508867 2669107080>
[EMAIL PROTECTED]
......W.
11:06:10.137761 IP spamd.server.smtp > mail.client.57588: P 11:89(78) ack 1 win
17376 <nop,nop,timestamp 2669107082 8508867>
[EMAIL PROTECTED]@..]..*..1.......PL}EX.!..C.d .....
..W.....sk.boing.org.nz ESMTP spamd I
11:06:10.179711 IP mail.client.57588 > spamd.server.smtp: . ack 89 win 5840
<nop,nop,timestamp 8508978 2669107082>
[EMAIL PROTECTED]
...2..W.
11:06:10.179835 IP mail.client.57588 > spamd.server.smtp: P 1:31(30) ack 89 win
5840 <nop,nop,timestamp 8508978 2669107082>
[EMAIL PROTECTED]
...2..W.NOOP
11:06:10.180265 IP spamd.server.smtp > mail.client.57588: P 89:137(48) ack 31
win 17376 <nop,nop,timestamp 2669107082 8508978>
[EMAIL PROTECTED]@.....*..1.......PL.EX.?..C.O_.....
..W....2451 Temporary failure, please
11:06:10.180366 IP spamd.server.smtp > mail.client.57588: F 137:137(0) ack 31
win 17376 <nop,nop,timestamp 2669107082 8508978>
[EMAIL PROTECTED]@..Z..*..1.......PL.EX.?..C.<......
..W....2
11:06:10.220941 IP mail.client.57588 > spamd.server.smtp: P 31:37(6) ack 137
win 5840 <nop,nop,timestamp 8508982 2669107082>
E..:[EMAIL PROTECTED];.....
...6..W.QUIT
11:06:10.220990 IP spamd.server.smtp > mail.client.57588: R
2840612091:2840612091(0) win 0
E..([EMAIL PROTECTED]@.mg..*..1.......PL.....P...x...
11:06:10.221686 IP mail.client.57588 > spamd.server.smtp: F 37:37(0) ack 138
win 5840 <nop,nop,timestamp 8508982 2669107082>
[EMAIL PROTECTED]
.1....*.....EX.E.PL.....i......
...6..W.
11:06:10.221706 IP spamd.server.smtp > mail.client.57588: R
2840612092:2840612092(0) win 0
E..(&[EMAIL PROTECTED]@.....*..1.......PL.....P...x...
11:06:11.855533 IP mail.client.57600 > spamd.server.smtp: S
1168868619:1168868619(0) win 5840 <mss 1460,sackOK,timestamp 8509145
0,nop,wscale 0>
E..<[EMAIL PROTECTED]
............
11:06:11.855578 IP spamd.server.smtp > mail.client.57600: S
2404738027:2404738027(0) ack 1168868620 win 16384 <mss
1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 1826281131 8509145>
[EMAIL PROTECTED]@[EMAIL PROTECTED]@..X.................
l.......
11:06:11.897884 IP mail.client.57600 > spamd.server.smtp: . ack 1 win 5840
<nop,nop,timestamp 8509150 1826281131>
[EMAIL PROTECTED]
....l...
11:06:12.026198 IP spamd.server.smtp > mail.client.57600: P 1:2(1) ack 1 win
17376 <nop,nop,timestamp 1826281132 8509150>
E..5([EMAIL PROTECTED]@../..*..1.......Uc.E.....C..4.....
l.......2
11:06:12.068415 IP mail.client.57600 > spamd.server.smtp: . ack 2 win 5840
<nop,nop,timestamp 8509167 1826281132>
[EMAIL PROTECTED]<.....
....l...
11:06:13.041558 IP spamd.server.smtp > mail.client.57600: P 2:3(1) ack 1 win
17376 <nop,nop,timestamp 1826281134 8509167>
[EMAIL PROTECTED]@.hA..*..1.......Uc.E.....C.. .....
l.......2
11:06:13.082602 IP mail.client.57600 > spamd.server.smtp: . ack 3 win 5840
<nop,nop,timestamp 8509268 1826281134>
[EMAIL PROTECTED]
...Tl...
11:06:14.152420 IP spamd.server.smtp > mail.client.57600: P 3:4(1) ack 1 win
17376 <nop,nop,timestamp 1826281136 8509268>
E..5&[EMAIL PROTECTED]@.....*..1.......Uc.E.....C........
l......T0
11:06:14.193736 IP mail.client.57600 > spamd.server.smtp: . ack 4 win 5840
<nop,nop,timestamp 8509380 1826281136>
[EMAIL PROTECTED]
....l...
11:06:15.099784 IP spamd.server.smtp > mail.client.57600: P 4:5(1) ack 1 win
17376 <nop,nop,timestamp 1826281138 8509380>
[EMAIL PROTECTED]@.....*..1.......Uc.E.....C..E.....
l.......
11:06:15.144584 IP mail.client.57600 > spamd.server.smtp: . ack 5 win 5840
<nop,nop,timestamp 8509474 1826281138>
[EMAIL PROTECTED]
..."l...
11:06:16.154241 IP spamd.server.smtp > mail.client.57600: P 5:6(1) ack 1 win
17376 <nop,nop,timestamp 1826281140 8509474>
[EMAIL PROTECTED]@.....*..1.......Uc.E.....C........
l......"b
11:06:16.195132 IP mail.client.57600 > spamd.server.smtp: . ack 6 win 5840
<nop,nop,timestamp 8509580 1826281140>
[EMAIL PROTECTED]
....l...
11:06:17.326398 IP spamd.server.smtp > mail.client.57600: P 6:7(1) ack 1 win
17376 <nop,nop,timestamp 1826281142 8509580>
[EMAIL PROTECTED]@.....*..1.......Uc.E.....C..w.....
l.......a
11:06:17.367980 IP mail.client.57600 > spamd.server.smtp: . ack 7 win 5840
<nop,nop,timestamp 8509697 1826281142>
[EMAIL PROTECTED]
....l...
11:06:18.005080 IP spamd.server.smtp > mail.client.57600: P 7:8(1) ack 1 win
17376 <nop,nop,timestamp 1826281144 8509697>
[EMAIL PROTECTED]@.]...*..1.......Uc.E.....C........
l.......s
11:06:18.046734 IP mail.client.57600 > spamd.server.smtp: . ack 8 win 5840
<nop,nop,timestamp 8509765 1826281144>
[EMAIL PROTECTED]
...El...
11:06:19.004413 IP spamd.server.smtp > mail.client.57600: P 8:9(1) ack 1 win
17376 <nop,nop,timestamp 1826281146 8509765>
[EMAIL PROTECTED]@.....*..1.......Uc.E.....C........
l......Ei
11:06:19.045178 IP mail.client.57600 > spamd.server.smtp: . ack 9 win 5840
<nop,nop,timestamp 8509865 1826281146>
[EMAIL PROTECTED]
....l...
11:06:20.046278 IP spamd.server.smtp > mail.client.57600: P 9:10(1) ack 1 win
17376 <nop,nop,timestamp 1826281148 8509865>
[EMAIL PROTECTED]@.....*..1.......Uc.E.....C..Q.....
l.......l
11:06:20.087601 IP mail.client.57600 > spamd.server.smtp: . ack 10 win 5840
<nop,nop,timestamp 8509969 1826281148>
[EMAIL PROTECTED]
....l...
11:06:21.007748 IP spamd.server.smtp > mail.client.57600: P 10:11(1) ack 1 win
17376 <nop,nop,timestamp 1826281150 8509969>
[EMAIL PROTECTED]@.x...*..1.......Uc.E.....C........
l.......i
11:06:21.048569 IP mail.client.57600 > spamd.server.smtp: . ack 11 win 5840
<nop,nop,timestamp 8510065 1826281150>
[EMAIL PROTECTED]
...ql...
11:06:22.105921 IP spamd.server.smtp > mail.client.57600: P 11:89(78) ack 1 win
17376 <nop,nop,timestamp 1826281152 8510065>
[EMAIL PROTECTED]@..h..*..1.......Uc.E.....C.C......
l......qsk.boing.org.nz ESMTP spamd I
11:06:22.147960 IP mail.client.57600 > spamd.server.smtp: . ack 89 win 5840
<nop,nop,timestamp 8510175 1826281152>
[EMAIL PROTECTED]
....l...
11:06:22.148584 IP mail.client.57600 > spamd.server.smtp: P 1:31(30) ack 89 win
5840 <nop,nop,timestamp 8510175 1826281152>
[EMAIL PROTECTED]".1....*.....E....UdD...........
....l...NOOP
11:06:22.149140 IP spamd.server.smtp > mail.client.57600: P 89:137(48) ack 31
win 17376 <nop,nop,timestamp 1826281152 8510175>
[EMAIL PROTECTED]@.....*..1.......UdDE..*..C.&......
l.......451 Temporary failure, please
11:06:22.149256 IP spamd.server.smtp > mail.client.57600: F 137:137(0) ack 31
win 17376 <nop,nop,timestamp 1826281152 8510175>
[EMAIL PROTECTED]@.p...*..1.......UdtE..*..C........
l.......
11:06:22.189686 IP mail.client.57600 > spamd.server.smtp: P 31:37(6) ack 137
win 5840 <nop,nop,timestamp 8510179 1826281152>
E..:[EMAIL PROTECTED]
....l...QUIT
11:06:22.189688 IP mail.client.57600 > spamd.server.smtp: F 37:37(0) ack 138
win 5840 <nop,nop,timestamp 8510179 1826281152>
[EMAIL PROTECTED]>.1....*.....E..0.Udu....A......
....l...
11:06:22.189719 IP spamd.server.smtp > mail.client.57600: R
2404738164:2404738164(0) win 0
E..([EMAIL PROTECTED]@.....*..1.......Udt....P...{X..
11:06:22.189735 IP spamd.server.smtp > mail.client.57600: R
2404738165:2404738165(0) win 0
E..([EMAIL PROTECTED]@.|%..*..1.......Udu....P...{W..
